GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v7 full-closure)

Principal: Mos (orchestrator, merge authority for the mosaic-stack governance lane). Committed under a DISTINCT git identity (mos-orchestrator@mosaic.local) — deliberately NOT the ms-lead-reviewer@mosaic.local lane signer that authored both the harness and the §3 review — so this record stands as a distinct-identity co-attestation. See "Independence" below.

Verify class: independent provider-byte read (guarded git show <full-40>:path | sha256sum) plus source-level inspection of the executed mechanism. Not a re-build, not a re-run. This SUPERSEDES the v6 co-attestation 12914d8 (and its SUPERSEDED-note b6bd0cd), which was byte-clear on the v6 bar only and was overtaken by homelab's third-principal FAIL @2d54a9dd + the resulting stricter full-closure bar.

Package under attestation

Artifact	Ref
Branch	`feat/827-gate0-probe`
Harness commit-40	`f609a44953f5ae61916805fcb45ca337de00b0b0`
Harness `p3_d4_focused_run.py` sha256	`0f1bd1b39399b32f243d901230e2d840794a2144edd723a095dab716833a7a9b` (32071 B)
§3-review-v7 commit-40	`2bba933f67c821899d320a938a9473a73a136422` (adds only the review `.md`; harness parent byte-stable)
Review path	`docs/compaction-refresh/reviews/GATE0-PROBE3-V7-FULLCLOSURE-S3-REVIEW-v7.md`

Pinned closure (all 3 sha256 INDEPENDENTLY recomputed by Mos from git objects == pins):

Member	Source (commit:path)	Pin sha256	Size
launcher `launch-runtime.py`	`f4008307:packages/mosaic/framework/tools/lease-broker/launch-runtime.py`	`e950e422…`	4237 B
helper `lease_generation.py`	`f4008307:packages/mosaic/framework/tools/lease-broker/lease_generation.py`	`061625402f…`	3769 B
broker `p3_generation_broker.py`	`23c0caca:docs/compaction-refresh/probes/p3_generation_broker.py`	`4db4fef1…`	—

Note: f4008307 (the held WI-3 #830 gated head) is not on origin — it exists only as a local git worktree on the build host. Mos recomputed the launcher+helper pins from that worktree (stack-cr-wi3-revoke, HEAD == f4008307) rather than passing over a clone-completeness gap. The broker pin was recomputed from origin 23c0caca.

Findings — VERDICT: byte-scope + mechanism + hygiene PASS (v7 full-closure bar)

Homelab's stricter bar — hashed==executed on the FULL executed closure (launcher + helper + broker) — is met. Verified at the source, not accepted on the review's assertion:

B5 conjunction (the load-bearing repair) — HELD, all three legs:

(a) materialized from pinned git-object bytes, NOT the mutable worktree. materialize_closure fetches each member via git_object_bytes (git show {commit}:{path}), then sha256(data) == pin fail-closed (RuntimeError on mismatch) before use.
(b) no writable window hash→consume. pinned/ is mkdir(mode=0o700); each file is written with os.open(O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0o600) — O_EXCL refuses a pre-planted file. No chmod, no os.rename/replace, no symlink, and nothing re-opens a pinned file for write (grep = 0). The pinned bytes are immutable within the fixture threat model between hash and exec.
(c) re-hash == pin IMMEDIATELY before each exec, no interleaved yield. Launcher: re-hash then return PiRpc(command,…) whose __init__ first statement is subprocess.Popen(command,…) — zero IO/yield/reopen between. Broker + helper: both re-hashed then subprocess.Popen on the next line. Adjacency-alone-without-materialization (the v6 defect) is absent — all three exec from pinned/.

B6 — helper pinned AND bound to the SAME single copy. The broker receives --generation-module {closure.generation} (the pinned helper); the launcher runs from pinned/ so its import lease_generation resolves to the sibling pinned copy via sys.path[0]. closure_import_guard AST-parses every member and raises on any non-stdlib import other than the allowed lease_generation — proving the dependency closure is complete and no unpinned module can enter at runtime.

Closure = exactly 3 files, materialized inside the fixture root (root / "pinned"). No path escapes the fixture temp root; no live/default broker; .state remains fixture-bound. R1 owner tripwire NOT tripped — this deepened isolation of an already-authorized touch, it did not widen the touched surface.

Invariants (all INTACT): BAR1 GATED_WI_HEAD == f4008307 and merge-base --is-ancestor 66b1e0a0 f4008307 = YES (file-backed .state revocation fidelity present); BAR2 .state = socket_path.parent / generation-{sid}.state, state_file_in_fixture_root + generation_source == "state-file" checks present; BAR3 lease_anchor_registered / live-path / fixture-socket isolation intact. -O-safe (0 bare assert); ABSENT-sweep (yolo/execRuntime/p3_bank/promote_p2/retry) = 0; single broker (1 def + 1 call site); --runs choices=(3,); allow-list env (0 os.environ.copy); the only shutil.copy2 is the legitimate .pi/agent credential copy (settings/auth/fd), not a launcher/helper/broker copy — the v6 copy-to-fixture concern is gone.

Independence

Substantive principal-independence of review-v7 is satisfied by an orchestrator-dispatched, builder-distinct Opus SECREV (ms-secrev-828, byte-only, non-builder) — that IS the substance of Gate-16.
The shared ms-lead-reviewer git signer on both the harness (ms-rev-826 build) and the review commit is evidentiary, not substantive. It is resolved by (1) this Mos co-attestation under a distinct identity (mos-orchestrator), and (2) a homelab third-principal verify under its own distinct identity — three distinct-identity principals of record. Tracked fleet-infra tooling-gap (durable fix = per-lane distinct signers), not a blocker.

Scope of this record — byte-clear, NOT fire-authorization

Producing probe evidence executes the Gate0 mechanism; a byte-clear is not a fire-authorization. This co-attestation clears the bytes / scope / mechanism / hygiene on the v7 full-closure bar. FIRE remains gated on: homelab third-principal re-verify (under its own distinct identity) + Mos transparency-to-Jason + Mos explicit FIRE GO. Until then: nothing banked, WI-3 #830 held at f4008307 (unmoved), C-hatch armed (if the materialized-closure rig still no-fire / wrong-value / assertion-FAIL / isolation-FAIL → possible Case-C → STOP + escalate to Jason).

Mos verdict: v7 full-closure byte-scope + mechanism + hygiene PASS. Co-attestation of record — committed.

⚠️ SUPERSEDED — homelab v7 third-principal FAIL @f609a449 raised a stricter bar (evidence-integrity note)

This co-attestation was byte-clear on the v7 full-closure bar ONLY and self-limited above to "byte-clear NOT fire-authorization; FIRE remains gated on homelab third-principal re-verify." Homelab (the required third principal) subsequently returned FAIL @f609a449 (static verify, no code run), and Mos UPHELD it after independently confirming both findings in source — so the v7 byte-clear this document records is SUPERSEDED and does NOT authorize FIRE.

Two residual isolation/binding holes WITHIN the materialized closure (both independently reproduced by Mos in the harness source; accepted as gate-strengthening, not softening):

Broker child env not isolated. launch_verified_broker (:551) calls Popen with no env= (only PiRpc.__init__ :50 passes an allow-listed env) → the broker child inherits ambient os.environ (PYTHONPATH/PYTHONHOME/PYTHONPYCACHEPREFIX). closure_import_guard is a static AST check and cannot bind the child's runtime stdlib resolution.
Executed bytecode-cache outside the pin. No PYTHONDONTWRITEBYTECODE/-I/-B/__pycache__ handling anywhere. exec_module on the pinned helper writes derived .pyc the pin never covers; only the .py is re-hashed → executed bytecode ≠ pinned-source-hash.

Both break "hashed==executed on the FULL executed closure" on fidelity grounds even in a non-adversarial fixture. Mos authorized the bounded repair (broker Popen with strict allow-listed env= + -I + PYTHON* stripped; bytecode-cache suppressed via PYTHONDONTWRITEBYTECODE=1/-B + reject stray __pycache__/.pyc fail-closed before each consumer; launcher sibling-import binding to the pinned helper preserved). This rides the existing (ii)-full-closure authorization + R1 + Mos adjudication — it deepens isolation/binding of an already-authorized touch, stays inside the fixture temp root, no fresh Jason owner-window. It is NOT a Case-C escalation (no probe fired, no evidence produced — a static pre-fire catch, exactly what the review gate is for). Added review bars B7 (broker child env-isolated) and B8 (executed bytecode pinned-or-suppressed) on top of B5+B6+all priors.

Live target = v8 (env-isolated + bytecode-pinned harness, forthcoming). f609a449 / 2bba933f / this co-attestation (e08ad03) are SUPERSEDED. A fresh Mos co-attestation will be committed on v8 byte-verify PASS. WI-3 #830 remains HELD at f4008307; nothing banked; C-hatch armed; NO FIRE.

9.2 KiB Raw Blame History